Azure Metrics and Azure Logs not same values

AccaEmme 11

Hi,

I'm not understanding why if I use "Azure Metrics" -> add metric -> filter from 01st Jan 2025 to 13th Jan 2025 I see 174M of requests

and if I use "Azure Logs" quering AppRequests via KQL I just retrive 21M of request.

Any Suggest?

What's wrong?

User's image

Pavan Minukuri 1,040 Reputation points Microsoft Vendor

2025-01-20T20:11:13.43+00:00

Hi @AccaEmme Just checking in to see if the below answer provided by @Stanislav Zhelyazkov helped. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Pavan Minukuri 1,040 Reputation points Microsoft Vendor

2025-01-21T18:05:46.31+00:00

Hi @AccaEmme , We haven't heard back from you. Please reply if you have any questions in this matter and we will gladly continue the discussion.
AccaEmme 11 Reputation points

2025-01-22T07:50:21.61+00:00

The problem is not solved

1 answer

Stanislav Zhelyazkov 25,491 Reputation points MVP

2025-01-14T07:45:55.5333333+00:00
Hi,

I think the issue comes with something called Sampling in Application Insights. The correct way to count the number of requests in AppRequests table is:

AppRequests | summarize totalCount=sum(ItemCount)

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.
AccaEmme 11 Reputation points

2025-01-14T08:47:25.2766667+00:00

Not solved

Stanislav Zhelyazkov 25,491 Reputation points MVP

2025-01-14T12:15:40.0733333+00:00

Overall you will never be able to get the exact number on both. They will be close but not exact. Sampling can happen inside or outside of the time window you have specified and depending on that will count or not. Additionally as far as I can understand you are checking number of request on Azure Web App and data in Log Analytics. If you have multiple web apps sending requests data to the Log Analytics workspace you need to modify the query to filter on requests only for that app.

AccaEmme 11 Reputation points

2025-01-14T14:46:02.8233333+00:00

Thanks for your answer,

but it's hard for me belive that 23M is closer to 187M and I don't understand why

187M is the result of request to the single webapp via "Azure Metrics"

23M is the result of request to the

the period is for both from 01st Jan to 14th Jan

Stanislav Zhelyazkov 25,491 Reputation points MVP

2025-01-14T18:11:50.2433333+00:00

Are you sure that table AppRequests in Log Analytics contains data only for that web app? Additionally from the screenshot you had one 1 hour difference 08:42 vs 09:42. Also make sure when you choose the time they are either in utc or the same local time.

Stanislav Zhelyazkov 25,491 Reputation points MVP

2025-01-14T18:13:31.5766667+00:00

Also can you describe the integration you use to get data from the web app to table AppRequests in Log Analytics.

AccaEmme 11 Reputation points

2025-01-15T10:32:52.0066667+00:00

In the AppRequests table of Log Analytics I have data from multiple web apps, which I can filter by url, but this further supports my doubt: for the same period, in AppRequests even though I have multiple web apps I have fewer values than in Azure Metrics, why?

Even though I align both extractions on UTC, the difference in results is still too big, I don't understand what I'm doing wrong

Stanislav Zhelyazkov 25,491 Reputation points MVP

2025-01-15T14:46:36.9533333+00:00

You can filter the different apps by column _ResourceId. That contains the resource id of each app. There is possibility also that you have different slots reporting as well so you should filter on that specific web app without any of the slots that you are viewing in metrics. Not sure what you mean filter by URL as filtering is done with column like _ResourceId, web apps are not represented as urls. As I have explained already when viewing via Azure Metrics you are viewing a single web app for its production slot. When you view data via AppRequests table there is possibility that you are viewing requests from multiple web apps and slots.

AccaEmme 11 Reputation points

2025-01-21T10:28:49.1766667+00:00

I thank you for your reply, but perhaps I am not expressing myself well enough to explain the situation.

I have re-run the extractions with the instructions you gave me, it keeps giving wrong values.

Regardless of whether I apply conditions in the KQL or not, I don't understand why I get so many more requests from the Metrics than I get from the AppRequests schema via KQL, this is really absurd, comparing based on the same period for the same service the values are too different!

I therefore wonder whether AppRequests reflects the values of the Metrics or whether I am doing something wrong.

Maybe because the diagnostic settings of the application insight does not include something?

Maybe the Metrics on the webapps include something more than they should? (The webapp has only one service)

Stanislav Zhelyazkov 25,491 Reputation points MVP

2025-01-21T12:01:59.4566667+00:00

Hi,

You are not sending the logs via diagnostic settings as you do not have any configured. This means you are sending them via Application Insights integration. Assuming that you have .net app as web app that means most likely that adaptive sampling is enabled. I would advise you to read again the information on sampling. In short the information you see in metrics in the web app view will never be the same as the information in AppRequests table. If you want to have every request logged you can use diagnostic settings to send data to Log Analytics. Enabling HTTP logs to be send to Log Analytics will result in exact number of requests in metrics to appear in AppServiceHTTPLogs table. That of course will cost you more. Sampling is good as most of the time you do not need all the logs to make proper analysis or to troubleshoot issues. And to be exactly clear the difference will be significant when adaptive sampling is used. You can read more on the sampling link from the initial response.

Going back to AppRequests table you can run query like:

AppRequests | distinct AppRoleName, _ResourceId

to check if you have multiple values for those two pairs. If you have multiple values. you should filter like:

AppRequests | where AppRoleName == '<your value here>' | where _ResourceId == '<your value here>' | summarize totalCount=sum(ItemCount)

in order to get the requests coming only for specific web app and application insights instance.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure Metrics and Azure Logs not same values

1 answer

Your answer